Virtual machine configuration method, apparatus, and system, device, medium, and program product

Abstract

Embodiments of the present application relate to the field of virtualization technology, and disclose a virtual machine configuration method, apparatus, and system, a device, a medium, and a program product, which improves the security of virtual machine configuration information storage. The method comprises: determining a secure storage space of a target virtual machine, wherein the secure storage space stores security configuration information of the target virtual machine, and the target virtual machine has read-only access to the secure storage space; and mapping the secure storage space to a network interface card, wherein the network interface card is a trusted device, and the network interface card has read-write access to the secure storage space.

Description

Virtual machine configuration method, device, system, equipment, medium and program product

[0001] The present application claims priority from the Chinese patent application No. 202410798682.9 filed on June 19, 2024, and entitled "Virtual machine configuration method, device, system, equipment, medium and program product", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the virtual technology field, in particular to a virtual machine configuration method, device, system, equipment, medium and program product. BACKGROUND

[0003] Currently, under the full virtualization technology, the control channel is completely allocated and maintained by the virtual machine driver, and the address mapping relationship between the virtual machine and the physical machine is maintained by the page table established by the virtual machine monitor. The configuration information can be directly exposed to the virtual machine tenant, and the memory area storing the configuration information can be directly modified.

[0004] Under the related technology, since the configuration information of the virtual machine saves the mapping relationship between the user registration storage space and the actual DMA address, it directly affects the action of directly accessing the memory through the data channel. Since the virtual machine is an untrusted device, when the tenant of the virtual machine maliciously tampers with the content of the configuration information, the network card may get the wrong direct data access address, thereby affecting the normal function of the network card. SUMMARY

[0005] The embodiments of the present application provide a virtual machine configuration method, device, system, equipment, medium and program product, which improves the security of the configuration information storage of the virtual machine.

[0006] In a first aspect, the present application provides a virtual machine configuration method, which is applied to a virtual machine monitor, and the method comprises: determining a secure storage space of a target virtual machine, the secure storage space storing secure configuration information of the target virtual machine, the target virtual machine having read-only permission for the secure storage space; and mapping the secure storage space to a network card, wherein the network card is a trusted device, and the network card has read-write permission for the secure storage space.

[0007] It can be understood that before the target virtual machine operates the business, the target virtual machine needs to be configured securely, and the secure configuration information of the target virtual machine needs to be written into the secure storage space, so that the target virtual machine and other untrusted devices cannot directly modify the secure configuration information. Mapping the secure storage space to the network card can enable the network card as a trusted device to perform read-write operations on the secure storage space, thereby avoiding the network card failure caused by the modification of the secure configuration information by the untrusted device, and improving the security of the configuration information storage of the virtual machine.

[0008] In a possible implementation, the mapping of the secure storage space to the network card comprises: writing address information of the secure storage space into a memory of the network card.

[0009] It can be understood that the writing of the address information of the secure storage space into the memory of the network card by the virtual machine monitor can enable the network card to determine the storage space allocated to the target virtual machine for storing the secure configuration information.

[0010] In a possible implementation, the determining of the secure storage space of the target virtual machine comprises: determining the secure storage space of the target virtual machine based on a specification of the target virtual machine.

[0011] It can be understood that the secure storage space required to be allocated is different for different specifications of virtual machines, and therefore the corresponding secure storage space can be allocated to the target virtual machine according to the specification of the target virtual machine, so as to ensure that the corresponding secure storage space of the target virtual machine can normally store the secure configuration information of the virtual machine.

[0012] In a possible implementation, if the target virtual machine comprises a plurality of virtual functions (VFs), the method further comprises: determining, based on a specification of a VF in the target virtual machine, a secure storage space corresponding to the VF in the target virtual machine from the secure storage space; and wherein the secure storage space of the target virtual machine comprises a plurality of secure storage spaces corresponding to the VFs.

[0013] It can be understood that the target virtual machine can comprise a plurality of VFs, and in order to ensure that each VF is allocated with a corresponding secure storage space, the VFs can be taken as a granularity, and the corresponding secure storage space can be allocated to each VF according to the specification of the VF.

[0014] In a second aspect, the present application provides a virtual machine configuration method, which is applied to a network card, the network card storing information of a secure storage space of a target virtual machine, the secure storage space storing secure configuration information of the target virtual machine, and the method comprising: obtaining a first packet sent by the target virtual machine, the first packet being used to indicate that the secure configuration information of the target virtual machine is modified; the first packet comprising a first address; and modifying the secure configuration information stored in the first address.

[0015] It can be understood that when the target virtual machine needs to modify the corresponding secure configuration, the target virtual machine can send a first packet for modifying the secure configuration information of the target virtual machine to the network card, and when the network card obtains the first packet and the first address of the first packet belongs to an address in the secure storage space, the network card as a trusted device can modify the secure configuration information in the secure storage space, thereby avoiding the network card failure caused by the modification of the secure configuration information by a non-trusted device, and improving the security of the storage of the configuration information of the virtual machine.

[0016] In a possible implementation, before obtaining the first packet sent by the target virtual machine, the network card further comprises: performing security verification on the received packet by the driver; and determining the packet that passes the security verification as the first packet.

[0017] It can be understood that, in order to ensure that the network card cannot maliciously modify the security configuration information in the secure storage space, the packet that passes the security verification can be determined as the first packet after the security verification on the received packet, so that the network card modifies the security configuration information according to the first packet subsequently, thereby ensuring the security of the configuration information storage of the virtual machine.

[0018] In a possible implementation, the method further comprises:

[0019] obtaining a second packet sent by another device, the second packet comprising a second address, the second address being a memory address of the target virtual machine; if the memory indicated by the second address is in the secure storage space, prohibiting memory read and write according to the second address; and if the memory indicated by the second address is not in the secure storage space, performing memory read and write according to the second address.

[0020] It can be understood that, in order to ensure that the read and write operations of the other packets except the first packet cannot modify the security configuration information in the secure storage space, it can be determined whether the memory indicated by the second address in the second packet is in the secure storage space, thereby improving the security of the configuration information storage of the virtual machine.

[0021] In a possible implementation, the method further comprises: if the target virtual machine is unloaded, deleting the security configuration information corresponding to the target virtual machine stored in the secure storage space; or if a virtual function (VF) in the target virtual machine is unloaded, deleting the security configuration information corresponding to the VF stored in the secure storage space.

[0022] It can be understood that, after the virtual machine is unloaded, the security configuration information stored in the secure storage space corresponding to the virtual machine can be deleted, so as to ensure that the storage resource is not invalidly occupied, and the utilization efficiency of the storage resource is improved.

[0023] In a third aspect, an embodiment of the present application provides a virtual machine configuration apparatus, which is used to execute any one of the virtual machine configuration methods provided in the first aspect.

[0024] In a possible implementation, the virtual machine configuration apparatus can be divided into function modules according to the method provided in the first aspect. For example, each function module can be divided according to each function, or two or more functions can be integrated into one processing module. For example, the virtual machine configuration apparatus can be divided into a determining module, a mapping module, and the like according to functions. The possible technical solutions and beneficial effects of each function module described above can be referred to the technical solutions provided in the first aspect or the corresponding possible implementation of the first aspect, which will not be described here.

[0025] In a fourth aspect, an embodiment of the present application provides a virtual machine configuration apparatus, which is used to execute any one of the virtual machine configuration methods provided in the second aspect.

[0026] In a possible implementation, the virtual machine configuration apparatus can be divided into function modules according to the method provided in the second aspect. For example, each function module can be divided according to each function, or two or more functions can be integrated into one processing module. For example, the virtual machine configuration apparatus can be divided into a first obtaining module, a modifying module, and the like according to functions. The possible technical solutions and beneficial effects of each function module described above can be referred to the technical solutions provided in the second aspect or the corresponding possible implementation of the second aspect, which will not be described here.

[0027] In a fifth aspect, an embodiment of the present application provides a computing device, which includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, the computer instructions are loaded and executed by the processor to enable the computing device to implement the virtual machine configuration method in the above aspect.

[0028] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, which stores at least one computer program instruction, the computer program instruction is loaded and executed by a processor to implement the virtual machine configuration method in the above aspect.

[0029] In a seventh aspect, an embodiment of the present application provides a computer program product, which includes computer instructions stored in a computer readable storage medium. The processor of the computing device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computing device cluster to execute the virtual machine configuration method provided in the various optional implementation of the first aspect.

[0030] The detailed description of the third aspect to the seventh aspect and various implementation manners thereof in the present application can refer to the detailed description in the first aspect and various implementation manners thereof, the second aspect and various implementation manners thereof; and the beneficial effects of the third aspect to the seventh aspect and various implementation manners thereof can refer to the beneficial effect analysis in the first aspect and various implementation manners thereof, the second aspect and various implementation manners thereof, which will not be described herein again.

[0031] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0032] FIG. 1 is a schematic diagram of a virtual machine configuration scenario according to an example embodiment;

[0033] FIG. 2 is a schematic diagram of an architecture of a virtual machine configuration system according to an example embodiment;

[0034] FIG. 3 is a schematic diagram of a flow of a virtual machine configuration method according to an example embodiment;

[0035] FIG. 4 is a schematic diagram of a secure storage space allocation process of a virtual machine involved in the embodiment shown in FIG. 3;

[0036] FIG. 5 is a schematic diagram of a flow of a virtual machine configuration method according to an example embodiment;

[0037] FIG. 6 is a schematic diagram of a secure configuration information modification process involved in the embodiment shown in FIG. 5;

[0038] FIG. 7 is a schematic diagram of a structure of a virtual machine configuration apparatus according to an example embodiment;

[0039] FIG. 8 is a schematic diagram of a structure of a virtual machine configuration apparatus according to an example embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical scheme and advantages of the present application more clear, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0041] In the present document, “multiple” refers to two or more. “And / or” describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. The character “ / ” generally represents an “or” relationship between the associated objects before and after it.

[0042] Also, in the description of the present application, unless otherwise specified, “plurality” means two or more than two. “At least one of the following” or the like means any combination of the items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can mean a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be a single item or a plurality of items.

[0043] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the same items or similar items with basically the same functions and effects are distinguished by using “first”, “second”, etc. The skilled in the art can understand that “first”, “second”, etc. do not limit the quantity and execution order, and “first”, “second”, etc. also do not necessarily mean different. At the same time, in the embodiments of the present application, “exemplary” or “for example” is used to represent as an example, illustration or description. Any embodiment or design scheme described as “exemplary” or “for example” in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the use of “exemplary” or “for example” is intended to present the relevant concept in a specific manner, for understanding.

[0044] Hereinafter, the related terms involved in the embodiments of the present application are briefly introduced.

[0045] Remote direct data access (RDMA) protocol: The RDMA protocol is a protocol generated to solve the delay of server-side data processing in network transmission. The RDMA protocol can realize the rapid movement of data from one system to the memory of a remote system without causing any impact on the operating system, avoiding occupying the redundant processing resources of the computing device.

[0046] Among them, the RDMA protocol can include inifiniband (IB), RDMA over converged ethernet (RoCE) and iWARP based on transmission control protocol (TCP) / internet protocol stack. The IB network card, intelligent network card, data processing unit (DPU) network card and other devices can use the RDMA protocol to realize the RDMA function.

[0047] RDMA over converged ethernet (RoCE): RoCE is a converged Ethernet based remote direct memory access protocol, and there are currently two versions of RoCEv1 based on IP encapsulation and RoCEv2 based on UDP encapsulation. When communicating through RoCE, a queue pair (QP) needs to be created to save the state of the flow, so the traffic communicated through RoCE is a stateful traffic.

[0048] Specifically, the RoCE protocol distinguishes control channels and data channels. The control channel is used for device management and resource management such as QP, queue, memory region (MR), etc. The user mode driver needs to be forwarded to the processing unit of the network card supporting the RoCE protocol after passing through the kernel mode driver. The data channel can be used for data request and completion data movement operations, and the user mode driver directly interacts with the processing unit of the network card supporting the RoCE protocol. The context information related to the queue, MR, etc. under the control channel, such as the context information usually includes the queue pair context (QPC), the completion queue context (CQC), the memory translation table (MTT) of the virtual address to the physical address of the MR, and other related information related to the address translation and the maintenance of the state of the service, the context information directly affects the network card supporting the RoCE protocol, such as the resource security of the DPU network card and the data memory access (DMA) process of the data channel message.

[0049] RoCE protocol virtualization generally includes full virtualization, semi-virtualization, and hardware virtualization technologies. Among them, the full virtualization technology is to take the hypervisor as the only intermediate layer of the virtual machine and the RoCE network card (a network card supporting the RoCE protocol), and the control channel and the data channel are all proxied by the hypervisor. The semi-virtualization technology can include pure software and hardware-assisted solutions. The pure software semi-virtualization technology is to use the front end and the rear end of the abstract layer (Virtio) principle in the semi-virtualization hypervisor located above the device to simulate, the front end is located in the virtual machine driver, and the rear end is located in the physical machine hypervisor, and the control channel and the data channel are jointly proxied by the front-end driver and the rear-end hypervisor. The hardware-assisted solution is to simulate the control channel by the front end and the rear end, and the data channel does not pass through the hypervisor, and the hardware pass-through technology is adopted. The hardware virtualization technology is to use the extension specification (single root I / O virtualization, SR-IOV) technology of the high-speed serial communication interconnection standard (peripheral component interconnect express, PCIe) specification to virtualize the RoCE network card hardware and pass it through to the virtual machine for use.

[0050] DPU: DPU is a chip-on-chip that supports flexible programmability and has high computing power and high-performance data processing capability. DPU can be used to share complex calculations that general computing power cannot afford, and is mainly applied to data-centric scenarios such as network, virtualization, storage, security, etc. By offloading network, storage, computing, and other tasks to the DPU network card, data can be calculated nearby to reduce the participation of the CPU, thereby achieving hardware acceleration effect of business. In addition, the DPU network card supporting the RoCE protocol can be deployed in a cloud scenario, in order to improve resource efficiency, cloud service providers can virtualize the network card hardware resources through virtualization technology, and allocate virtual machines to tenants for use.

[0051] Hypervisor: Hypervisor is a virtual machine monitor, which is an intermediate software layer running between the physical layer and the virtual layer, and can be used to virtualize the resources of the physical machine and allocate them to the virtual machine for use.

[0052] Virtual function (VF): is a type of virtual network card channel virtualized from a physical network card, such as, can be regarded as a kind of virtual network card.

[0053] QPC: Wherein, QP is a queue structure in RoCE, containing connection-oriented reliable service (RC), datagram-oriented unreliable service (UD) and other service types, used to establish point-to-point communication between two nodes. Each QP contains a sending queue and a receiving queue, which can be regarded as a kind of virtual channel. And QPC describes the relevant attributes of QP, used to transfer information between software and hardware, including the size of sending / receiving queue, queue address, access permission, etc. Since the context involves network card resources, the modification of the context by the user of the virtual machine may affect the normal operation of the DPU network card in the cloud scenario.

[0054] CQC: Wherein, CQ can be a queue used to store completion events, indicating the completion of an RDMA (Remote Direct Memory Access) operation. CQC is context information used to describe the relevant attributes of CQ, used to transfer information between software and hardware, including the size of completion queue, queue address, etc.

[0055] MR: Before the RoCE service (service using RoCE protocol) is started, it needs to call the application program interface (application program interface, API) to register a block of continuous virtual memory block and allocate it to the RoCE service for use. In the process of use, the page mapping relationship corresponding to the virtual memory block is fixed and saved as the MTT table.

[0056] MTT table: Before establishing the service channel, RoCE will establish and save the mapping table of the virtual address to the physical address of MR, that is, the MTT table. Through the MTT table, the RoCE network card can directly DMA data from the network card to the system memory without going through the system kernel.

[0057] Secure storage space: Memory region registered or allocated for virtual machine to use as secure storage space, data stored in secure storage space does not support modification or write operation by untrusted device, only supports modification or write operation by trusted device, wherein, untrusted device can be virtual machine device allocated to tenant, trusted device can be host device or network card device in cloud, by setting secure storage space, it can be guaranteed that the data stored in the secure storage space will not be maliciously tampered with by untrusted devices.

[0058] Security configuration information: the security configuration information is the configuration information that needs to be protected for the virtual machine, for example, it can be context information, and the context information usually can include QPC, CQC, MTT and other related information related to business state maintenance, address translation and the like. The context information directly affects the network card supporting the RoCE protocol, so the context information needs to be protected to avoid untrusted devices modifying it at will, thereby causing the network card to be abnormal and affecting the normal RDMA function.

[0059] The application scenarios of the embodiments of the present application are exemplarily introduced below.

[0060] At present, by deploying network cards supporting the RDMA protocol, such as IB network cards, intelligent network cards, DPU network cards and the like, into a cloud scenario, big data transmission, low-latency read-write, high-concurrency access and other businesses can be performed, and by using virtualization technology to virtualize the hardware resources of the network card, virtual machine resources can be allocated to users for rent to improve resource utilization efficiency.

[0061] Taking the RoCE protocol as an example, the RoCE protocol mechanism can protect the user memory through memory registration, protection domain, access key and other mechanisms, but in the out-of-band mechanism, it is impossible to exclude the possibility of malicious tampering of the virtual machine tenant with the memory. This results in that the virtualization technology for the RoCE network card does not consider the allocation and protection mechanism of the secure storage space, and there is a possibility that the tenant maliciously attacks and tampers with the security configuration information that needs to be stored in the secure storage space, which can cause the entire network card hardware access to be abnormal, and further cause other virtual machines to be affected.

[0062] Specifically, the following ways of allocating a secure storage space to store security configuration information exist.

[0063] Under the full virtualization technology, the security configuration information is completely allocated and maintained by the virtual machine driver, and the address mapping relationship MTT between the virtual machine and the physical machine is maintained by the Hypervisor to establish a page table. The data channel also needs to pass through the Hypervisor, and its performance and latency are subject to software constraints. The security configuration information is directly exposed to the virtual machine tenant, and the security configuration information in the secure storage space can be directly modified.

[0064] For example, the security configuration information is taken as the context information. The context information is directly stored in the user memory allocated to the virtual machine (VM), and the VM can directly access and modify the context information stored in the user memory. This results in certain security problems, because the context information stores the mapping relationship between the user registered MR and the actual DMA address, such as the MTT table, and modification of the above information can directly affect the action of the RoCE data channel DMA memory. That is, the RoCE network card can directly DMA the valid data of the message to the GPA address stored in the table after obtaining the MTT table. In the virtualization scenario, the VM is an untrusted device, and when the tenant of the VM maliciously tampers with the context information, that is, the table content, the RoCE network card can obtain the wrong DMA address. Of course, the context information such as QP and CQ can also be modified, which will affect the normal function of the DPU network card.

[0065] Therefore, the embodiment of the present application provides a virtual machine configuration method. The security storage space storing the security configuration information of the virtual machine is determined by the virtual machine monitor, so that the untrusted device such as the virtual machine has only read permission for the security storage space, and the trusted device such as the network card has read and write permissions for the security storage space. The virtual machine cannot directly modify the security configuration information in the security storage space, and the trusted device such as the network card can modify the security configuration information in the security storage space, thereby avoiding the problem that the normal function of the network card is affected due to the malicious tampering of the untrusted device with the security configuration information in the security storage space, and improving the security of the security configuration information storage.

[0066] In some embodiments, in the method provided by the embodiment of the present application, first, the virtual machine monitor can determine the security storage space of the target virtual machine, the security storage space stores the security configuration information of the target virtual machine, and the virtual machine monitor can set the target virtual machine to have only read permission for the security storage space. Then, the virtual machine monitor can map the security storage space to the network card of the trusted device, and the network card can have read and write permissions for the security storage space. Since the virtual machine monitor sets the security storage space to have only read permission for the target virtual machine, it can be ensured that the target virtual machine cannot directly modify the security configuration information stored in the security storage space, and mapping the security storage space to the network card of the trusted device can ensure that the network card as the trusted device can modify the security configuration information stored in the security storage space. Therefore, the problem that the normal function of the network card is affected due to the malicious tampering of the untrusted device with the security configuration information in the security storage space is avoided, and the security of the security configuration information storage is improved.

[0067] Exemplarily, FIG. 1 is a schematic diagram of a virtual machine configuration scenario provided by an embodiment of the present application. As shown in FIG. 1, in a cloud scenario, a cloud side includes physical hosts such as a computing device 1 and a computing device 2, and each computing device can run one or more virtual machines (VMs). For example, the computing device 1 can run n virtual machines such as VM1, VM2, and VMn, and each virtual machine can be rented by a user device on a user side. The user device that rents the virtual machine provided by the cloud side can use the network, computing, storage, and other resources of the computing device in the cloud side to run a business. After creating a virtual machine, the computing device on the cloud side can configure the virtual machine. Some security configuration information in the configuration information needs to be avoided from being modified or written by an untrusted device. In order to avoid the problem that the normal function of a network card is affected due to malicious tampering of the security configuration information by the untrusted device, a secure storage space needs to be determined, and the virtual machine is set to have read-only permission for the security configuration information stored in the secure storage space, so as to ensure that the user device cannot modify the security configuration information stored in the secure storage space when renting the virtual machine, and further ensure the normal running of the virtual machine business.

[0068] Hereinafter, the system architecture of an embodiment of the present application is exemplarily introduced.

[0069] FIG. 2 is a schematic diagram of an architecture of a virtual machine configuration system provided by an embodiment of the present application. As shown in FIG. 2, the virtual machine configuration system can be applied to a computing device 10 on a cloud side. The computing device 10 can include a virtual machine monitor 11, a network card 12, and a virtual machine 13. The virtual machine monitor 11 is intermediate software running between a physical layer and a virtual layer of the virtual machine configuration system, and can be used to virtualize the resources of a physical host and allocate the virtualized resources to the virtual machine for use. The network card 12 can be a network card supporting an RDMA protocol, such as an IB network card, an intelligent network card, or a DPU network card. The virtual machine 13 can be rented by a user device and run on a physical host. The virtual user memory (MR) and the secure storage space of the virtual machine can be allocated by the virtual machine monitor 11. The secure storage space is used to store security configuration information, and the virtual machine running an application can start a stateful business driver. The stateful business can be a business that needs to store related data in the process of business execution, and the related data can be stored in the MR of the virtual machine.

[0070] The virtual machine configuration system can be applied to a computing device on a cloud side.

[0071] In an embodiment of the present application, the computing device can be a network device or an electronic device.

[0072] The network device can include a server or the like. The server can be one physical or logical server, or two or more physical or logical servers sharing different responsibilities and working together to implement the functions of the server.

[0073] For example, the server can be a blade server, a high-density server, a rack server, or a tower server, etc.

[0074] It should be noted that the application scenarios and system architectures described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of system architecture and the appearance of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0075] For ease of understanding, the virtual machine configuration method provided by the present application is exemplarily introduced below in combination with the accompanying drawings. The virtual machine configuration method is applicable to the computing device shown in FIG. 1.

[0076] FIG. 3 shows a flow diagram of a virtual machine configuration method provided by an example embodiment of the present application. The virtual machine configuration method can be executed by a virtual machine monitor. The virtual machine configuration method includes the following steps:

[0077] S101, the virtual machine monitor determines a secure storage space of a target virtual machine.

[0078] In the embodiments of the present application, the virtual monitor can allocate a memory region to the target virtual machine as a secure storage space.

[0079] The secure storage space can store secure configuration information of the target virtual machine, and the target virtual machine has read-only permission for the secure storage space.

[0080] In a possible implementation, on the physical host side of the computing device, that is, locally in the computing device, a virtual machine memory pool can be included, or in a remote computing device, a virtual machine memory pool can be included. The virtual machine memory pool is a disk space allocated to the virtual machine for use. The virtual machine monitor can determine a continuous memory region in the virtual machine memory pool as the secure storage space.

[0081] The virtual machine monitor can set the permission of the determined secure storage space as read-only permission for the target virtual machine, so as to ensure that the target virtual machine can only read the data in the secure storage space, and cannot modify or write data in the secure storage space.

[0082] For example, the address of the disk space as the virtual machine memory pool can be from address a to address b. The virtual machine monitor can allocate the memory region in the virtual machine memory pool to each virtual machine as the virtual memory used by each virtual machine, and the virtual memory used by each virtual machine can include user memory and secure storage space, where the user memory can indicate the virtual memory space normally used by the virtual machine when the virtual machine is running a business, that is, the virtual machine can normally read and write the user memory.

[0083] In the address information of the secure storage space, the virtual memory allocated to each virtual machine can be a continuous memory space in the virtual machine memory pool that is not repeated, for example, if there are two virtual machines to be allocated virtual memory, that is, virtual machine 1 and virtual machine 2, the virtual memory allocated to virtual machine 1 can be a continuous memory space from address a to address c, and the virtual memory allocated to virtual machine 2 can be a continuous memory space from address c to address b. A continuous memory space is divided from the continuous memory space from address a to address c allocated to virtual machine 1 as the secure storage space of virtual machine 1, and a continuous memory space is divided from the continuous memory space from address c to address b allocated to virtual machine 2 as the secure storage space of virtual machine 2.

[0084] In a possible implementation, the virtual machine monitor can determine the secure storage space of the target virtual machine based on the specification of the target virtual machine.

[0085] That is, according to the granularity of the virtual machine, the virtual machine monitor determines the secure storage space corresponding to each virtual machine according to the specification of each virtual machine.

[0086] For example, a corresponding relationship between the requirement of the secure storage space corresponding to each virtual machine specification is pre-configured and stored, the virtual machine monitor determines the requirement of the secure storage space corresponding to the specification of the target virtual machine according to the corresponding relationship, and allocates the secure storage space to the target virtual machine according to the requirement of the secure storage space. The requirement of the secure storage space can include the size requirement of the secure storage space.

[0087] For example, if the specification of virtual machine 1 is obtained and it is determined that the requirement of the secure storage space corresponding to the specification of virtual machine 1 is a storage space size of x, the virtual machine monitor can determine a continuous memory region with a size of x from the virtual memory allocated to virtual machine 1 as the secure storage space of virtual machine 1.

[0088] Specifically, the virtual monitor can determine the address information of the secure storage space of the target virtual machine according to the specification of the target virtual machine, and the address information of the secure storage space can include the start address of the secure storage space and the memory length.

[0089] In a possible implementation, if the target virtual machine includes multiple VFs, the secure storage space corresponding to each VF in the target virtual machine is determined from the secure storage space of the target virtual machine based on the specifications of the VFs in the target virtual machine.

[0090] That is, after the virtual monitor allocates the secure storage space corresponding to the target virtual machine to the target virtual machine in granularity of virtual machine, the secure storage space corresponding to each VF in the target virtual machine can be determined in the secure storage space corresponding to the target virtual machine.

[0091] The secure storage space of the target virtual machine includes the secure storage spaces corresponding to the multiple VFs, that is, the secure storage spaces corresponding to the VFs in the target virtual machine are non-shared memory areas, and the secure storage spaces corresponding to the VFs in the target virtual machine are all in the secure storage space corresponding to the target virtual machine.

[0092] That is, after the virtual machine monitor determines the secure storage space corresponding to each virtual machine in granularity of virtual machine according to the specifications of each virtual machine, since the virtual machine can include multiple VFs, the secure storage space corresponding to each VF can be determined.

[0093] For example, if the virtual machine monitor determines that the address of the secure storage space corresponding to the target virtual machine is from address a to address b, the target virtual machine includes two VFs, i.e., VF1 and VF2, the address of the secure storage space corresponding to VF1 can be from address a to address c, and the address of the secure storage space corresponding to VF2 can be from address c to address b. That is, the total capacity of the secure storage spaces determined by each VF in the target virtual machine can be the capacity of the secure storage space corresponding to the target virtual machine.

[0094] For example, as shown in Table 1, the virtual machine specifications can be VM0, VM1 to VMm, the VF specifications of the VFs included in the virtual machine with the specification VM0 are vf0, and the VF specifications of the VFs included in the virtual machine with the specification VM1 are vf1, vf2, and vf3.

[0095] Table 1

[0096] The secure storage space allocated by the virtual machine monitor to VM0 is the same as the secure storage space allocated by the virtual machine monitor to vf0. The secure storage space allocated by the virtual machine monitor to VM1 is the sum of the secure storage space allocated by the virtual machine monitor to vf1, the secure storage space allocated by the virtual machine monitor to vf2, and the secure storage space allocated by the virtual machine monitor to vf3.

[0097] Specifically, the hypervisor determines the form of the secure storage space of the target virtual machine can be determined by determining the address information of the secure storage space.

[0098] The address information can include granularity information, a starting virtual address (GPA), and an address length (LEN). The granularity information indicates that the granularity corresponding to the secure storage space is a VM granularity or a VF granularity. The address information can be recorded as <VM / VF, GPA, LEN>.

[0099] In a possible implementation, the hypervisor can set the secure storage space of the target virtual machine as a read-only permission of the target virtual machine, to ensure that the target virtual machine cannot directly modify the security configuration information stored in the secure storage space.

[0100] In S102, the hypervisor maps the secure storage space to the network card.

[0101] The network card is a trusted device. Since the network card is a trusted device, the network card can have read and write permissions for the secure storage space.

[0102] In a possible implementation, the hypervisor can write the address information of the secure storage space into the memory of the network card, to complete the mapping process of the secure storage space to the network card.

[0103] The physical host side of the computing device can include a virtual machine memory pool, which can be used to allocate disk space to the virtual machine. After the hypervisor determines the secure storage space from the virtual machine memory pool, the hypervisor writes the address information of the secure storage space into a trusted area. The trusted area can be a storage space of the network card.

[0104] Alternatively, the trusted area can also be a specified area in the memory of the physical host side of the computing device, that is, the hypervisor writes the address information of the secure storage space into the specified area of the memory of the physical host side, and synchronously writes the address information into the cache of the network card, to ensure that the subsequent virtual machine can directly read the address information of the secure storage space from the network card, and avoid frequent access to the memory of the physical host side.

[0105] For example, FIG. 4 is a flow diagram of a process of allocating a secure storage space of a virtual machine according to an embodiment of the present application. As shown in FIG. 4, taking a DPU network card as an example, the DPU network card can include a memory module, the memory module can include a memory area (memory) and a cache, and after the virtual machine monitor determines the address information of the secure storage space allocated to VF0, VF1, and the like from the virtual machine memory pool on the physical host side, in one case, the virtual machine monitor can directly write the address information of the secure storage space allocated to VF0 into the memory of the memory module of the DPU network card, for example, the virtual machine monitor can write the address information in the format of <VF0, GPA, LEN> into the memory of the memory module of the DPU network card. In another case, the virtual machine monitor can write the address information of the secure storage space allocated to VF0 from the virtual machine memory pool on the physical host side into a specified area in the memory on the physical host side, and at the same time, the virtual machine monitor can synchronize the address information of the secure storage space allocated to VF0 to the cache of the memory module of the DPU network card through the driver of the physical host, and the address information written into the specified area in the memory on the physical host side and the address information synchronized to the cache of the memory module of the DPU network card can both be in the format of <VF0, GPA, LEN>.

[0106] After the virtual machine monitor maps the secure storage space to the network card, the target virtual machine can be initialized, and the target virtual machine can initialize and assign values to the secure storage space through the virtual machine driver.

[0107] For example, when the target virtual machine starts and loads a virtual function of a stateful service, the driver of the target virtual machine can read the address information of the secure storage space from the network card, so that the driver of the target virtual machine can use the secure storage space as a virtual storage space for storing security configuration information.

[0108] For example, when the target virtual machine loads VF0 of the RoCE service, and taking a DPU network card as an example, the driver of the target virtual machine can read the address information of the secure storage space, i.e., <VF0, GPA, LEN>, from the memory of the memory module of the DPU network card, and the target virtual machine can directly use the secure storage space indicated by the address information as a virtual storage space for storing security configuration information of the target virtual machine.

[0109] In one possible implementation, if the target virtual machine loads a virtual function of a stateless service after starting, the target virtual machine does not need to read the address information and directly loads the virtual function of the stateless service.

[0110] That is, in the initialization stage of loading the stateful service, the target virtual machine reads the address information of the secure storage space through the driver, sends a configuration request to the virtual machine monitor through the driver, the configuration request can include the security configuration information to be written into the secure storage space and the address information of the secure storage space, and the virtual machine monitor can store the security configuration information in the secure storage space according to the configuration request when it is determined that the content of the security configuration information meets the specified condition after receiving the configuration request.

[0111] Specifically, the driver of the target virtual machine can send a configuration request to the virtual machine monitor by calling a configuration API, and the configuration request is a request for assigning configuration information to the target virtual machine. Since the virtual machine monitor sets the usage permission of the secure storage space as read-only permission for the target virtual machine, the target virtual machine cannot directly write or modify the memory in the secure storage space. The driver of the target virtual machine is not allowed to directly write to the secure storage space. The M2 context memory area has direct write operation, and the configuration request of the target virtual machine is sent to the driver or DPU card on the physical host side or other trusted device to proxy the configuration of the target virtual machine, that is, the security configuration information is written into the secure storage space through the trusted device proxy.

[0112] In summary, the target virtual machine needs to be configured before the target virtual machine operates the service, and the security configuration information of the target virtual machine needs to be written into the secure storage space, so that the target virtual machine and other non-trusted devices cannot directly modify the security configuration information. Mapping the secure storage space to the network card can enable the network card as a trusted device to read and write the secure storage space, thereby avoiding the network card failure caused by the modification of the security configuration information by the non-trusted device, and improving the security of the configuration information storage of the virtual machine.

[0113] FIG. 5 shows a flowchart of a virtual machine configuration method provided by an example embodiment of the present application. The virtual machine configuration method can be executed by a network card, and the virtual machine configuration method includes the following steps:

[0114] S201, the network card obtains a first packet sent by a target virtual machine.

[0115] In the embodiment of the present application, after the virtual machine monitor has mapped the secure storage space of the target virtual machine to the network card, the network card obtains the first packet sent by the target virtual machine, and the first packet can be used to indicate that the security configuration information of the target virtual machine is modified. The first packet can include a first address.

[0116] The network card can have stored the address information of the security storage space of the target virtual machine, and the security configuration information after initialization assignment has been written in the security storage space. If the target virtual machine currently needs to modify the security configuration information stored in the security storage space, the target virtual machine needs to send a first message to the network card. Since the first message includes a first address, the network card can determine the security storage space according to the first address. In addition, since the first message also includes the content that needs to be modified in the security configuration information, the network card can modify the security configuration information in the security storage space according to the first message.

[0117] In a possible implementation, the received message is subjected to security verification by the driver, and the message that passes the security verification is determined as the first message.

[0118] The target virtual machine can send multiple messages to the network card. The multiple messages can include the first message or other messages. The first message is a message for applying to modify the security configuration information, and the other messages are messages irrelevant to the modification of the security configuration information. That is, the process of subjecting the multiple messages to security verification can be a case of screening the messages for applying to modify the security configuration information from the multiple messages. Alternatively, the first message can be a message containing a specified modification command. The specified modification command is a command for applying to modify the security configuration information. The other messages can also include other commands for applying to modify the security configuration information that do not conform to the specified modification command. That is, the process of subjecting the multiple messages to security verification can be a process of screening the messages that conform to the specified modification command and are for applying to modify the security configuration information from the multiple messages.

[0119] Exemplarily, the command operation and modification of the security storage space need to pass through a trusted device, such as the driver or the network card on the physical host side. In the trusted device, such as the network card or the physical host side, a command white list is set. The command white list includes a specified modification command. The modification indicated by the specified modification command is within the range allowed by the trusted device to modify the configuration information of the target virtual machine. After the trusted device receives the message sent by the target virtual machine, the message is compared with the command white list. If the message conforms to the specified modification command in the command white list, the message is determined as the first message, the corresponding security storage space is determined according to the address information in the first message, and the security configuration information in the security storage space is modified according to the modification command in the first message. Therefore, it is ensured that the target virtual machine cannot maliciously rewrite the security storage space. That is, through the mechanism, it is ensured that the security configuration information in the security storage space cannot be maliciously tampered with by the virtual machine tenant, and the normal function of the DPU network card is not affected.

[0120] S202, the network card modifies the security configuration information stored in the first address.

[0121] In the embodiment of the present application, after receiving the first message, the network card can determine the corresponding secure storage space according to the first address, and modify the security configuration information stored in the secure storage space, because the first address is included in the first message.

[0122] For example, FIG. 6 is a schematic diagram of a security configuration information modification process according to an embodiment of the present application. As shown in FIG. 6, the virtual machine driver can enable the context of the stateful service based on the mapped secure storage space, and send the first message for modifying the security configuration information to the network card. The first message is the message passed after the received message of the network card is verified according to the command whitelist. The security configuration information in the secure storage space can be modified according to the first message through the network card driver.

[0123] In a possible implementation, the network card can obtain a second message sent by another device, the second message including a second address, the second address being a memory address of a target virtual machine; if the memory indicated by the second address is in the secure storage space, memory read and write are prohibited according to the second address; if the memory indicated by the second address is not in the secure storage space, memory read and write can be performed according to the second address.

[0124] That is, the other device can be a device including the target virtual machine. When the other device sends the second message to the network card, if the second message is used to write data into the second address, the network card needs to determine whether the second address is within the range of the secure storage space. If the network card determines that the memory indicated by the second address is in the secure storage space, in order to ensure that the other device cannot modify the configuration information in the secure storage space, memory read and write can be prohibited according to the second address in the second message. If the network card determines that the memory indicated by the second address is not in the secure storage space, memory read and write can be normally performed according to the second address.

[0125] For example, if the virtual machine A needs to write data X into the memory space with the address c, the virtual machine A needs to send the second message containing the address c and the data to be written into the memory to the network card. The network card determines whether the address c is within the address range of the secure storage space. If the address c is within the address range of the secure storage space, the network card will not perform the write operation of data X on the memory indicated by the address c according to the second message. Otherwise, if the address c is not within the address range of the secure storage space, the network card performs the write operation of data X on the memory indicated by the address c according to the second message.

[0126] When the operating system of the target virtual machine is running, the configuration of the security configuration information is completed, at this time, the write action of the internal program of the virtual machine to the security storage space is prohibited, the access permission of the target virtual machine to the security storage space is set to read-only permission by the Hypervisor, and a check is performed. When the network card transmits and receives a packet, there may be a DMA or a completion event control signaling write action to the virtual memory of the target virtual machine, and the write action to the security storage space should be limited.

[0127] For example, the packet processing module of the network card reads the virtual machine security memory <VM, GPA, LEN> from the memory module. Optionally, if the Hypervisor does not support VF inter-page table isolation (usually the Hypervisor maintains the mapping of virtual machine virtual addresses to physical addresses through an IOMMU page table), then other VF modules also need to perform a DMA check action at the network card. For a pass-through network card, the legality of the address of the RX DMA and the control signaling in the receiving direction is checked, and the address object of the DMA is not allowed to be the security memory. For a non-pass-through network card, optionally, the Hypervisor can be introduced to perform a security check on the address of the received packet.

[0128] In a possible implementation, if the target virtual machine is unloaded, the security configuration information corresponding to the target virtual machine stored in the security storage space is deleted, or if the virtual function VF in the target virtual machine is unloaded, the security configuration information corresponding to the VF stored in the security storage space is deleted.

[0129] That is, when the VF network card or the virtual machine is destroyed, the Hypervisor needs to recycle the security storage space of the context, and actively initiates an action of clearing the configuration information such as <VM / VF, GPA, LEN> related to the security storage space of the context on the network card.

[0130] In summary, when the target virtual machine needs to modify the corresponding security configuration, the target virtual machine can send a first packet for modifying the security configuration information of the target virtual machine to the network card, and when the first packet is obtained and the first address of the first packet belongs to the address in the security storage space, the network card as a trusted device can modify the security configuration information in the security storage space, thereby avoiding the network card failure caused by the modification of the security configuration information by the untrusted device, and improving the security of the configuration information storage of the virtual machine.

[0131] The above describes the scheme of the embodiments of the present application mainly from the method aspect. It can be understood that the virtual machine configuration apparatus includes at least one of the hardware structure and the software module for performing the respective functions in order to implement the above functions. Those skilled in the art should easily realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented in the form of hardware or the combination of hardware and computer software. Whether a certain function is implemented in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0132] The embodiments of the present application can divide the functional units of the virtual machine configuration apparatus according to the above method examples. For example, each functional unit can be divided according to each function, or two or more functions can be integrated in one processing unit. The integrated unit can be implemented in the form of hardware or software functional unit. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division. In actual implementation, there can be another division manner.

[0133] For example, FIG. 7 shows a structural schematic diagram of a virtual machine configuration apparatus 500 provided by an example embodiment of the present application. The virtual machine configuration apparatus 500 is applied to a computing device, or the virtual machine configuration apparatus 500 can be a computing device. The virtual machine configuration apparatus 500 includes:

[0134] A determination module 510 is configured to determine a secure storage space of a target virtual machine, wherein the secure storage space stores secure configuration information of the target virtual machine, and the target virtual machine has read-only permission for the secure storage space.

[0135] A mapping module 520 is configured to map the secure storage space to a network card, wherein the network card is a trusted device, and the network card has read-write permission for the secure storage space.

[0136] In a possible implementation, the mapping module is further configured to write address information of the secure storage space into a memory of the network card.

[0137] In a possible implementation, the determination module is further configured to determine the secure storage space of the target virtual machine based on a specification of the target virtual machine.

[0138] In a possible implementation, if the target virtual machine includes multiple virtual functions (VF), the determining module is further configured to determine the secure storage space corresponding to the VF in the target virtual machine from the secure storage space based on the specification of the VF in the target virtual machine; and the secure storage space of the target virtual machine includes the secure storage spaces corresponding to the multiple VF.

[0139] For example, FIG. 8 shows a structural schematic diagram of a virtual machine configuration apparatus 600 provided by an example embodiment of the present application. The virtual machine configuration apparatus 600 is applied to a computing device, or the virtual machine configuration apparatus 600 can be a computing device. The virtual machine configuration apparatus 600 includes:

[0140] The first obtaining module 610 is configured to obtain a first packet sent by the target virtual machine, where the first packet is used to indicate that the security configuration information of the target virtual machine is modified, and the first packet includes a first address.

[0141] The modifying module 620 is configured to modify the security configuration information stored in the first address. In a possible implementation, the mapping module is further configured to write the address information of the secure storage space into the memory of the network card.

[0142] In a possible implementation, the network card includes a driver, and the apparatus further includes:

[0143] The checking module is configured to perform security check on the received packet through the driver before obtaining the first packet sent by the target virtual machine.

[0144] The determining module is configured to determine the packet that passes the security check as the first packet.

[0145] In a possible implementation, the apparatus further includes:

[0146] The second obtaining module is configured to obtain a second packet sent by another device, where the second packet includes a second address, and the second address is a memory address of the target virtual machine.

[0147] The processing module is configured to, if the memory indicated by the second address is in the secure storage space, prohibit memory reading and writing according to the second address.

[0148] The processing module is further configured to, if the memory indicated by the second address is not in the secure storage space, perform memory reading and writing according to the second address.

[0149] In a possible implementation, the apparatus further includes:

[0150] The deletion module is configured to delete the security configuration information corresponding to the target virtual machine stored in the security storage space if the target virtual machine is unloaded, or delete the security configuration information corresponding to a virtual function (VF) in the target virtual machine stored in the security storage space if the VF is unloaded.

[0151] The specific description of the optional manner can refer to the foregoing method embodiments, and will not be described here. In addition, the explanation and beneficial effect of any of the virtual machine configuration apparatuses provided above can refer to the corresponding method embodiments described above, and will not be described here.

[0152] The embodiments of the present application further provide a computer program product containing instructions. The computer program product can be software or a program product containing instructions, which can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, the at least one computing device is caused to perform the virtual machine configuration method.

[0153] The embodiments of the present application further provide a computer readable storage medium. The computer readable storage medium can be any available medium that a computing device can store or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk), etc. The computer readable storage medium includes instructions indicating the computing device to perform the digital resource management method, or indicating the computing device to perform the virtual machine configuration method.

[0154] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A virtual machine configuration method characterized by, The method is applied to a virtual machine monitor, and the method comprises: determining a secure storage space of a target virtual machine, the secure storage space storing secure configuration information of the target virtual machine, the target virtual machine having read-only permission for the secure storage space; mapping the secure storage space to a network card, wherein the network card is a trusted device, and the network card has read-write permission for the secure storage space.

2. The method of claim 1, wherein, The secure storage space is mapped to the network card, comprising: writing address information of the secure storage space into a memory of the network card.

3. The method according to claim 1 or 2, characterized in that, The secure storage space of the target virtual machine is determined, comprising: determining the secure storage space of the target virtual machine based on a specification of the target virtual machine.

4. The method of claim 3, wherein, If the target virtual machine includes a plurality of virtual functions (VF), the method further comprises: determining, based on a specification of the VF in the target virtual machine, the secure storage space corresponding to the VF in the target virtual machine from the secure storage space; wherein the secure storage space of the target virtual machine contains the secure storage spaces corresponding to the plurality of VFs.

5. A virtual machine configuration method characterized by, The method is applied to a network card, and the network card stores information of a secure storage space of a target virtual machine, the secure storage space storing secure configuration information of the target virtual machine, and the method comprises: obtaining a first packet sent by the target virtual machine, the first packet being used to indicate modification of the secure configuration information of the target virtual machine; the first packet comprising a first address; modifying the secure configuration information stored in the first address.

6. The method of claim 5, wherein, The network card comprises a driver, and before the first packet sent by the target virtual machine is obtained, the method further comprises: performing security check on the received packet by the driver; determining the packet that passes the security check as the first packet.

7. The method according to claim 5 or 6, characterized in that, The method further comprises: obtaining a second packet sent by another device, the second packet comprising a second address, the second address being a memory address of the target virtual machine; if the memory indicated by the second address is in the secure storage space, prohibiting memory reading and writing according to the second address; if the memory indicated by the second address is not in the secure storage space, performing memory reading and writing according to the second address.

8. The method according to any one of claims 5 to 7, characterized in that, The method further comprises: if the target virtual machine is unloaded, deleting the secure configuration information corresponding to the target virtual machine stored in the secure storage space; or if a virtual function (VF) in the target virtual machine is unloaded, deleting the secure configuration information corresponding to the VF stored in the secure storage space.

9. A virtual machine configuration apparatus characterized by comprising: The device is applied to a virtual machine monitor, and the device comprises: a determining module configured to determine a secure storage space of a target virtual machine, the secure storage space storing secure configuration information of the target virtual machine, the target virtual machine having read-only permission for the secure storage space; a mapping module configured to map the secure storage space to a network card, wherein the network card is a trusted device, and the network card has read-write permission for the secure storage space.

10. The apparatus of claim 9, wherein, The mapping module is further configured to write address information of the secure storage space into memory of the network card.

11. The apparatus of claim 9 or 10, wherein, The determining module is further configured to determine the secure storage space of the target virtual machine based on a specification of the target virtual machine.

12. The apparatus of claim 11, wherein, If the target virtual machine includes a plurality of virtual functions (VFs), the determining module is further configured to determine, based on a specification of the VFs in the target virtual machine, the secure storage space corresponding to the VFs in the target virtual machine from the secure storage space; wherein the secure storage space of the target virtual machine contains the secure storage spaces corresponding to the plurality of VFs.

13. A virtual machine configuration apparatus characterized by comprising: The device is applied to a network card, and the network card stores information of a secure storage space of a target virtual machine, and the secure storage space stores secure configuration information of the target virtual machine. The device comprises: A first obtaining module is configured to obtain a first packet sent by the target virtual machine, and the first packet is used to indicate modification of the secure configuration information of the target virtual machine; and the first packet comprises a first address. A modifying module is configured to modify the secure configuration information stored in the first address.

14. The apparatus of claim 13, wherein, The network card comprises a driver, and the device further comprises: A checking module is configured to perform security checking on a received packet through a driver before obtaining the first packet sent by the target virtual machine. A determining module is configured to determine the packet that passes the security checking as the first packet.

15. The apparatus of claim 13 or 14, wherein, The device further comprises: A second obtaining module is configured to obtain a second packet sent by another device, and the second packet comprises a second address, and the second address is a memory address of the target virtual machine. A processing module is configured to, if the memory indicated by the second address is in the secure storage space, prohibit memory reading and writing according to the second address. The processing module is further configured to, if the memory indicated by the second address is not in the secure storage space, perform memory reading and writing according to the second address.

16. The apparatus of any one of claims 13 to 15, wherein, The device further comprises: A deleting module is configured to, if the target virtual machine is unloaded, delete the secure configuration information corresponding to the target virtual machine stored in the secure storage space; or, if a virtual function (VF) in the target virtual machine is unloaded, delete the secure configuration information corresponding to the VF stored in the secure storage space.

17. A virtual machine configuration system, characterized by The system comprises: A virtual machine monitor is configured to determine a secure storage space of a target virtual machine, the secure storage space stores secure configuration information of the target virtual machine, the target virtual machine has read-only permission for the secure storage space; and map the secure storage space to a network card, wherein the network card is a trusted device, and the network card has read-write permission for the secure storage space. A network card is configured to obtain a first packet sent by the target virtual machine, the first packet being used to indicate that the security configuration information of the target virtual machine is to be modified; the first packet comprises a first address; the security configuration information stored in the first address is modified; and the network card stores information of a security storage space of the target virtual machine, the security storage space storing the security configuration information of the target virtual machine.

18. A computing device, comprising: The computing device comprises a processor and a memory, and the processor of the computing device is configured to execute instructions stored in the memory of the computing device, so that the computing device performs the virtual machine configuration method according to any one of claims 1 to 8.

19. A computer-readable storage medium, characterized in that, The computer program product comprises instructions, which, when executed by a computing device cluster, cause the computing device cluster to perform the virtual machine configuration method according to any one of claims 1 to 8.

20. A computer program product, characterised in that, The computer program product comprises instructions, which, when executed by a computing device cluster, cause the computing device cluster to perform the virtual machine configuration method according to any one of claims 1 to 8.

Images